What's a "SNORT signature" ? 1

[diogenes10]

Looking over the introductory material in one of Sgtb's recommended reads.
Sentence something like
"Some people download SNORT signatures daily."
The word SNORT does not appear in the index -- security concepts and terminology all foreign to me.
Thanks.

 

[kittenhammer]

SNORT is a free intrusion detection tool.

http://www.snort.org

 

[diogenes10]

Thanks, I found a chapter on intrusion detection in the middle of the book which I scanned over. It seems to talk about products named tripwire and aide. At the rate I read it will be awhile before I get through the book in sequence with all the background for that chapter.
What does a signature file for intrusion detection do? Is it like virus definitions giving the system something to check against, or is it a listing of some kind of potential problems?

 

[pansophic]

It is exactly like a virus definition for antivirus software. It is a compilation of unique traits for a session or packet that match a specific exploit. When that set of traits are identified, the IDS will generate an alert for that exploit. Based on your configuration, it will log it and/or notify you.


pansophic